This privacy notice sets out details of the information we collect about you, how we may use it, how we ensure it’s kept secure, who we share it with, and what rights you may have in respect of that information.

• We mainly use your personal information to provide our services to you, to meet our legal obligations, and to help improve our interests.
• We only want to hold as much personal information as we need to do the above.
• We want our personal information relationship to be reciprocal where we both benefit, not an exploitative one.
• Where we share your data, we only do so with organisations who have a right to see it and who will use it fairly.
• We take security seriously.
• You can contact us at anytime about anything relating to this notice or the information we hold about you.
• You can choose to delete your online Membership account via the App, which can be done by selecting “Settings”, “Find out more about this app” and “Delete my account”. As you will see, this would mean you’d no longer be able to use any of the online Membership services connected to the email address you provided for the App, although you will still be a Co-op Member.

Who we are

This Notice applies to all the entities within the Co-operative Group Limited (“we”, “us” and “The Co-op”) to the extent that they are controllers of your personal information.

We’re committed to respecting the information you trust us with and making sure that we keep it safe. The Co-op has a family of businesses including Food, Insurance, Legal Services and Funeralcare.

Why we ask for your personal information

Where we need your information to do what we’ve promised

Our main use of your information is where it’s necessary to supply you with our products and services, or where it's necessary as part of the management of our Membership programme.

For example, we’d need your name, address and payment details when you join as a Member so we can:

• register your share in the Co-op
• send your Membership card
• take your £1

Where we need your personal information to help us get better at everything we do

These are things we consider to be our legitimate interests, some of which are more relevant to certain Co-op Group businesses than others.

• Developing an understanding of the activities, preferences, and requirements of our Members and Customers. For example, we’ll track activity on our website and App, sometimes using cookies to understand the pages people visit so we can offer the best layout of our site. Sometimes we’ll contact you to seek feedback on a product or service you’ve requested.
• For statistical analysis to improve existing products and services and develop new products and services.
• To better understand the common and more general needs of our customers and members. This helps us make sure we offer the right products and services and generally meet the needs of our Members. For example, it’s really useful for us to look at large sets of data to understand whether we’re better stocking skimmed or semi-skimmed milk.
• To give you a better and more personalised experience (this is sometimes referred to as 'profiling’). For example when using the App, we give you personalised offers based on your shopping habits. So if you buy a lot of apples, we might give you vouchers for apples (and not oranges). Sometimes, we'll probably make some wrong assumptions about you and we're really sorry about that. For example, maybe you'd prefer us to give vouchers for things you haven't tried rather than the things we think you want them for.
• Communicating with you about the products and services we’re providing to you. We may use your personal details to send you things we think you need to know about and things we are obliged to send you legally. We broadly term these "service" emails. For example we send Members details about things like changes to the benefits they get from membership. We may also send individual Members timely information we think they need to help them, for example when they have unsuccessfully attempted to sign-in to their account.
• Promoting, marketing and advertising our products and services. For example, we might look at a combination of your personal information to try and determine where we might be best placing a television or press advert.
• To obtain feedback on our performance, to assess customer service and satisfaction and to improve overall operations. This might include sending emails inviting you to provide feedback.
• Running checks for identification, creditworthiness and price setting against databases such as our Co-op Membership database, which contains information about our Members and how they use their Co-op Membership cards, the electoral register and other databases that contain publicly available information about County Court judgments, bankruptcy and repossessions.
• Managing services or insurance policies.
• Where you make a complaint, to handle that complaint and ensure that we are in the best position to address the issues you raise.

Other ways we might use your personal information

We may also need to process your personal data from time to time where necessary for:

• Preventing and detecting crime or anti-social behaviour. For example, we'll use CCTV in and around our buildings.
• Dealing with any legal claims.

If we're using your personal information in the above ways, we really understand that your data has a value and therefore we try to use it for everyone’s benefit. We also try really hard to ensure there will be little or no negative impact on you. This is part of our commitment to ensure that we consider all privacy concerns at the earliest possible opportunity.

Our legal basis for using your information

We will only use your personal information where:

We have your consent

For example we might rely on your consent in order to send you direct marketing communications. Where we do, you can withdraw your consent at any time, most typically by "unsubscribing" from our emails, or alternatively by contacting us at the details given below.

It's necessary for the purposes of our legitimate interests

These interests are set out above (see 'Where we need your personal information to help us get better at everything we do'), and we will only use such data where those interests are not outweighed by your own interests or fundamental rights and freedoms.

It's necessary for the performance of a contract

Either when we're in a contract with you or to take steps as requested by you prior to entering into a contract.

It's necessary for compliance with a legal obligation we have

To protect your vital interests

For example if we needed to share your information with a health professional because you’d fallen ill.

Please note that where we require you to provide certain information in order to perform our contractual obligations and you decline to do so, this may delay our performance of the contract or prevent us from honouring our contractual obligations.

The types of information we hold about you

Almost all of the information we have is the information you've given to us. That might be when you request a product, service, offers or news from us via our website, emails, telephone conversations, and written and verbal communication.

Obviously the types of information you give us will vary depending on the service you’ve requested but typically could include:

• name, address, and contact details
• details of products and services you've bought from us
• details of your interactions with us through our stores, contact centres, online or by using one of our Apps
• payment details
• call recordings
• information about how you interact with our communications
• visual images, personal appearance and behaviour (usually obtained from CCTV, or Body Worn Cameras)

As well as obtaining information from you, we may also collect it from:

• someone else acting on your behalf who gives us the information directly
• other Co-op Group companies such as Co-op Insurance, Funeralcare, Food and Legal Services
• publicly available sources such as social media and the electoral register
• fraud prevention and detection agencies, organisations and databases
• government and law enforcement agencies and regulators
• NHS organisations and systems such as your GP and Summary Card Record

It's also possible we might process other types of information that might be considered even more private, such as information relating to criminal offences and alleged offences. For example, if you wanted a quote for a Motor Insurance product we might need to ask about any criminal offences or health conditions. These are considered "special categories" of personal information and we're obliged to handle this information even more thoughtfully.

See a full list of special category information on the ICO's website.

Sharing your personal information

When we share your information, we only do so in accordance with our legal, data protection and privacy obligations.

Your information may be disclosed to the following:

• Service providers. We use a number of other organisations who carry out work on our behalf to help us provide our products and services. We ensure any third parties we may share your data with have at least the same privacy and security standards as ourselves and will only use your information for the specific reasons we ask them to.
• Companies, brands and businesses within the Co-operative Group. We may also share information throughout the Co-op for the reasons outlined such as core administration and activities that have been identified as being within our legitimate interests. For example, we'll share information from our Co-op Food stores and other businesses with our Membership department to ensure you receive your Membership rewards and there are similar arrangements between our other businesses. We may also share information where we decide to restructure part of our business and, for example, we transfer responsibility for the services we provide to you to another business within the Co-op Group - these entities are the same as those listed as controllers in this notice.
• Credit reference agencies. For example they may supply anti-fraud and credit-insight information to us.
• Social media companies and our advertising partners. For example we might match your email address with Facebook and Twitter to enable us to run promotions on their platforms. If you don’t want your data transferred to the Social Media sites you already use, please notify us at the contact details below.
• Our regulators. For example, we may need to share your information with the Solicitors Regulation Authority or the Legal Ombudsman if we are providing legal services to you.
• Our professional advisors. For example we may need to share information with our lawyers or auditors when they need it to give us their professional advice.
• Public authorities, agencies and other government bodies. For example we might need to provide your information to the police or other bodies such as the DVLA, the NHS Business Services Authority or your GP.
• Potential corporate buyers. Where we consider selling any of our Co-op Group businesses or substantially all of its assets to a third party outside the Co-op group. We may need to disclose documentation and other information that may include your personal information.

How long we keep personal information

We only keep your information for as long as it's needed for each of the activities we’ve identified in this Notice, as well as for as long as required in connection with our legal or regulatory obligations.

As you might expect, that will vary but we're happy to share more specific retention schedules if you wish to contact us on the contact details below.

Transferring your information outside the European Economic Area (EEA)

We may need to transfer your personal information outside of the EEA in order to provide you with the services and products you require or as necessary for our business. This will most likely occur when our third-party providers are based outside the EEA. Some of these countries may not have laws that protect privacy rights as extensively as in the EEA.

If we do transfer your personal information to other jurisdictions, we will take proper steps to ensure that your information is as equally protected as in the UK, such as entering into "standard data protection clauses" with the recipient. These are clauses that have been approved by the European Commission for such transfers.

Your rights about how your personal information is handled

Data protection laws provide you with a number of rights as set out below.

Right to access your personal data

You may request confirmation that we hold personal data about you, as well as access to a copy of any such data.

Right to rectification

You may ask us to rectify any inaccurate information we hold about you.

Right to erasure

You may ask us to delete your personal information

Right to restriction

You may ask us to restrict the processing of your personal information in certain circumstances.

Right to portability

You may request the receipt or transfer to another organisation in a structured, commonly used and machine-readable form, the personal data that you have provided to us.

Right to object

You may object to our processing of your personal information in certain circumstances.

Right to withdraw consent

Where our processing of your personal information is based on your consent, you may withdraw this consent at any time, although this won’t affect the lawfulness of any prior processing where we relied on your consent.

Right to make a complaint

You may make a complaint about our processing of your personal data by contacting us via the contact details provided in this Notice. While we hope that we would be able to address any issues you have in respect of this processing, you may also make a complaint to the UK’s data protection regulation - visit the Information Commissioner’s Office.

If you would like to exercise any of your rights, please contact us using the contact details set out below.

Automated processing

Sometimes we use your personal information in automated processes to make decisions about you, or to create a profile of you. If you are a Member, we may also generate a profile ‘score’ for you, which is designed to provide benefits such as discounts on Co-op products and services. Our use of automated decision making, for example in respect of our insurance products, is to help ensure that decisions are made accurately, fairly and efficiently.

How you can contact us

To find out what personal information we hold about you, print a subject access request form, fill it in and send it by post to:

GDPR Subject Access Request Team
Business Support Services
6th Floor
1 Angel Square
Manchester
M60 0AG

You can also send completed forms to sars@coop.co.uk

For other enquiries or to get a subject access request form by post, write to us at the address above or call 0800 0686 727.

The information we hold about you will depend on how you shop and interact with us, so the more information you can give about what it is you want you see, the quicker and more specific our response can be.

You also have the right to request we correct any inaccurate information we hold, as well as the right to object to profiling and the right to ask us to delete your information.

If you have any questions, concerns or objections about how we use your personal information please contact us using the details above.

If you have any concerns or complaints about how we handle your information you can complain to the Information Commissioner's Office, although we'd really like the chance to try and help with any issues first.

Changes to this Privacy Notice

We'll update this page if we decide to change our privacy policy so that you are always aware of the information we collect, how we use it and under what circumstances we disclose it.

If we make significant changes to the notice we’ll contact you directly to let you know.

We encourage you to check back regularly.